Benjamin JEAN
Known for his work on open source and open data, Benjamin Jean is currently CEO of inno³, an independent consultancy specialising in open models at the intersection of private (industrial and social economy), public (administrations and municipalities) and community actors. He is also co-founder and former president of " Open Law*, Le droit ouvert ", a French non-profit organisation promoting activities to support the transformation of the legal sector through digital co-creation programmes based on the principles of open data, open source and open innovation. Strongly mobilised by the opportunities offered by these open models in the digital transformation of professions and major industrial sectors, Benjamin Jean regularly intervenes as an expert at several events and conferences on these topics. In fact, in addition to his full-time job at inno3, he teaches intellectual property law at several universities, is a Master Conferences at Science Po and works as a consultant at the law firm Vercken & Gaullier. Actively involved in the open digital ecosystem, he collaborates and participates with many committed actors in this field. He is also present in several free software communities, administrator of Framasoft, and co-founder of Veni Vidi Libri and the annual conference cycle " European Open source & Free Software Law Event " (EOLE).
Session
Where does the Cyber Resilience Act leave Open Source projects? The first obligations for manufacturers apply from 11 September 2026: actively exploited vulnerabilities and severe incidents must be reported, with an early warning at 24 hours and a notification at 72 hours. Article 24(3) extends part of this to Open Source stewards, the Regulation's new category for foundations, but only where they take part in development or host its infrastructure. The Regulation applies in full, with a declaration of conformity and CE marking, from 11 December 2027.
The first part is a state of play for Open Source: who is in scope, how the commercial activity test works, and where manufacturers, stewards and contributors sit; what the Commission's guidance of 27 July 2026 settled; what the implementing regulation on important and critical products changed through its core functionality test; and what remains open while no harmonised standard is cited in the Official Journal, leaving no presumption of conformity.
The second part puts this into practice with The Document Foundation, which aims for the most demanding level of conformity for LibreOffice and treats its own status, whether manufacturer, steward or distributor, as something to establish rather than assume. We will walk through the work done with inno³ since spring 2026: Articles 13 and 14, the Annex I essential requirements, the Annex VII technical documentation, the resulting gap analysis and where TDF stands today. Reusable material will feed the next CRA and Open Source guide from inno³ and the CNLL.